WatchGuard Ransomware Attacks

Overview

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are now exploiting a critical WatchGuard Firebox firewall vulnerability tracked as CVE‑2025‑14733. This escalation highlights how unpatched perimeter devices remain prime targets for attackers.

Vulnerability Details

• Type: Out‑of‑bounds write leading to remote code execution (RCE).
• Attack complexity: Low, unauthenticated exploitation possible.
• Affected versions:
  • Fireware OS 11.x and later (including 11.12.4_Update1)
  • Fireware OS 12.x and later (including 12.11.5)
  • Fireware OS 2025.1 through 2025.1.3
• Configuration risk: Primarily affects devices using IKEv2 VPN, but exploitation may persist if branch office VPNs to static gateway peers remain configured.

Exploitation Context

• Initial exploitation: WatchGuard confirmed active exploitation in December 2025.
• Shadowserver scans: Over 115,000 Firebox firewalls were exposed online in December; nearly 9,000 remain unpatched nine months later.
• Ransomware involvement: CISA’s September 2026 update confirms ransomware gangs are now leveraging CVE‑2025‑14733.

Historical Context

• CVE‑2022‑23176: Actively exploited flaw in Firebox and XTM firewalls, patched under CISA directive.
• CVE‑2025‑9242: Another RCE vulnerability patched in September 2025, nearly identical to CVE‑2025‑14733. Shadowserver found 75,000 vulnerable Firebox devices one month later.

Defensive Guidance

Organizations should:

• Patch immediately to the latest Fireware OS release.
• Audit VPN configurations to ensure vulnerable setups are removed.
• Check indicators of compromise provided by WatchGuard and CISA.
• Restrict exposure by limiting internet‑facing access.
• Monitor logs for unusual VPN activity or code execution attempts.

Expert in the Cloud Insight

The exploitation of CVE‑2025‑14733 by ransomware gangs underscores the critical importance of patch discipline for perimeter devices. Firewalls are high‑value targets: once compromised, they provide attackers with direct access to internal networks. The lesson is clear: patch quickly, audit VPN configurations, and monitor for behavioral anomalies to prevent ransomware footholds.